cloud-penetration-testing

Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/cloud-penetration-testing/SKILL.md

Quality

Content

61%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is a dense, actionable cloud-pentesting cheatsheet with concrete commands for all three providers and a sensible phase structure, plus a real advanced-scripts reference. It is held back by duplicated boilerplate, externally referenced scripts without setup guidance, and the absence of per-phase validation/feedback loops for destructive operations.

Suggestions

Remove the duplicated 'AUTHORIZED USE ONLY' blockquote (the second near-identical instance) and trim the Purpose section so it does not restate the frontmatter description verbatim.

Add per-phase validation checkpoints and a fix-and-retry loop (e.g., after enumeration, verify scope and confirm authorization remains valid before moving to exploitation/persistence phases).

Document how to obtain or install the externally referenced tools (cloud_enum.py, ip2provider.py, MSOLSpray.ps1, FireProx) so the command examples are fully executable end-to-end.

Dimension	Reasoning	Score
Conciseness	The body is dominated by executable commands which earn their tokens, but it repeats the 'AUTHORIZED USE ONLY' blockquote twice, restates the description in the Purpose section, and duplicates phase commands in the Quick Reference tables.	3 / 5
Actionability	It provides concrete, mostly copy-paste-ready aws/gcloud/az commands across all three providers, but several external scripts (cloud_enum.py, ip2provider.py, MSOLSpray.ps1, fire.py) are referenced without installation or setup guidance.	4 / 5
Workflow Clarity	The 11 numbered phases are clearly sequenced and there is an upfront mandatory confirmation gate, but the phases themselves lack validation checkpoints or fix-and-retry feedback loops, and the destructive/offensive nature caps workflow clarity at 3 per the guidelines.	3 / 5
Progressive Disclosure	The body is well-organized into Prerequisites, Core Workflow phases, Quick Reference, Examples, and Constraints, with a single clearly signaled one-level-deep reference (references/advanced-cloud-scripts.md) that is a real file.	4 / 5
	Total	14 / 20 Passed

Description

61%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly identifies the cloud security assessment domain and the three target providers, but lacks an explicit 'when to use' trigger clause and the more natural 'pentest'/'penetration testing' phrasing users would invoke. It is reasonably specific and distinct but stops short of the strongest examples.

Suggestions

Add an explicit 'Use when...' clause naming concrete trigger scenarios, e.g. 'Use when performing authorized cloud penetration testing, red teaming, or security assessments of Azure, AWS, or GCP environments.'

Include natural trigger terms users actually say, such as 'cloud pentest', 'penetration testing', and 'red team', alongside 'security assessments'.

Enumerate 2-3 concrete assessment activities (reconnaissance, resource enumeration, privilege escalation) in the description to raise specificity beyond the single broad 'comprehensive security assessments' action.

Dimension	Reasoning	Score
Specificity	The description names the domain (cloud infrastructure across Azure, AWS, GCP) and one concrete action ('Conduct comprehensive security assessments'), but the action phrasing is broad rather than enumerating the specific techniques covered in the body.	3 / 5
Completeness	It clearly states what the skill does but provides no 'Use when...' clause or equivalent explicit trigger guidance, which caps completeness at 3 per the judging guidelines.	3 / 5
Trigger Term Quality	Natural terms like 'security assessments', 'cloud infrastructure', 'Azure', 'AWS', and 'GCP' are present, but common variations users would actually say such as 'pentest' or 'penetration testing' are missing.	4 / 5
Distinctiveness Conflict Risk	The cloud-penetration-testing niche across three named providers is mostly distinct with minimal conflict risk, though the generic 'comprehensive security assessments' could lightly overlap with broader security skills.	4 / 5
	Total	14 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (526 lines); consider splitting into references/ and linking	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	14 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/cloud-penetration-testing/SKILL.md
Commit: 1f67c44

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.